1. Who we are
SIA “Visual Communication Group”, trading as ADESIGN BUREAU, registration number 40203098040, registered office at Dzirciema iela 119C, Rīga, LV-1055, Latvia, is the controller of the personal data described in this Policy.
Privacy contact: adesign@adesign-bureau.com.
2. Scope
This Policy applies to our website, enquiries, business correspondence, project and contract administration, payments, and any separate consent for portfolio use. This Policy does not govern third-party websites that you choose to visit.
3. Data we collect
- Identity and contact data, such as your name, email address, company name and role.
- Enquiry and project data, including the country of the property, your brief, photographs, plans, descriptions, preferences, correspondence and other materials you choose to provide.
- Contract, billing and payment data, such as the agreed service, billing address, tax status, invoice details, amount, currency, payment status and payment-provider reference. We do not receive or store full payment-card numbers.
- Limited technical and security data generated when the website or email services are used, such as IP address, request time and security-event information.
- Portfolio data only where you have separately agreed to such use.
Please do not provide sensitive personal data or personal data about third parties unless it is necessary and you are entitled to provide it.
4. Why we use data
- To respond to enquiries and take steps requested before a possible contract — Article 6(1)(b) GDPR.
- To manage business correspondence and, where services are later agreed, perform the relevant agreement — Article 6(1)(b) GDPR.
- To comply with applicable legal obligations — Article 6(1)(c) GDPR.
- To protect our website and communications, keep proportionate business records and establish, exercise or defend legal claims — Article 6(1)(f) GDPR.
- To publish client work in our portfolio or social media — Article 6(1)(a) GDPR, based on separate consent. Refusing consent does not affect the service.
5. When information is required
You choose whether to contact us and what information to include. We may need basic contact details and sufficient information about your enquiry to respond or discuss a possible engagement. If that information is not provided, we may be unable to deal with the enquiry.
6. Recipients and service providers
We disclose data only as necessary to authorised personnel, professional advisers, competent authorities and providers supporting our communications, website, security and payments.
- Email: Google Workspace, operated by Google, for business correspondence.
- Website delivery and security: Cloudflare.
- Payments: our bank for bank transfers, and Stripe if you are sent and use an individual Stripe-hosted payment link or pay a Stripe invoice, for payment processing, fraud prevention and related transaction records.
7. International transfers
Some providers may process data outside the European Economic Area. Where required, transfers are protected by an adequacy decision, the European Commission’s Standard Contractual Clauses or another lawful mechanism. You may contact us for information about the safeguards applicable to a particular provider.
8. Retention and deletion
We keep personal data only for as long as necessary for the purpose for which it was collected and for applicable legal obligations.
- Unsuccessful or inactive enquiries and their attachments are deleted when they are no longer needed for follow-up, unless limited retention is necessary for a legal claim or another legal obligation.
- If services are agreed, electronic project materials and substantive project correspondence are kept only while needed to perform the service and are deleted promptly after completion, unless a dispute, legal hold or legal obligation requires limited retention.
- Printed working materials are kept securely and destroyed promptly after the relevant service is completed, unless their temporary retention is legally necessary.
- Records that must be kept under accounting, tax, contract or claims rules are retained for the applicable statutory or limitation period.
- Security logs and provider backups expire according to documented operational and provider cycles.
- Portfolio material is kept only while separate consent remains valid and the material is in use, subject to any necessary rights evidence.
9. Your rights
Subject to the GDPR and applicable limitations, you may request access, rectification, erasure, restriction, data portability, or object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent without affecting earlier lawful processing.
Send requests to adesign@adesign-bureau.com. We may request information necessary to verify your identity. You may lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija) at dvi.gov.lv or another competent supervisory authority.
10. Automated decisions
We do not make decisions producing legal or similarly significant effects based solely on automated processing.
11. Security
We use measures appropriate to the risks, including restricted access, multifactor authentication where available, encryption in transit, data minimisation, retention controls and incident procedures. No system can be guaranteed to be completely secure.
12. Changes
We may update this Policy when our services, providers or legal obligations change. The current version will be published with its effective date. Material changes affecting an existing order will be communicated where required.